# MITRE ATLAS

A knowledge base of adversary tactics and techniques specific to AI systems, structured like ATT&CK.

**Rests on:** Gold and Adversarial Sets

*Security and Privacy · AI Security*


## Why learn this

This concept gives you a shared vocabulary and a structured map for AI security. When you study attacks like prompt injection, data poisoning, or model extraction, ATLAS tells you where they fit, how real attackers combine them, and what to cover when securing an AI system. It is the industry-standard way to scope and communicate AI security work—essential for any security professional or AI builder.


## The intuition

Imagine a library where every known type of attack on AI systems is catalogued, not by the technology it exploits, but by the attacker's goal and the stage of the attack. This library is called MITRE ATLAS—Adversarial Threat Landscape for Artificial-Intelligence Systems. It is a knowledge base, like a Wikipedia of attacks, but structured so you can see the 'tactics' (the goal, like 'initial access' or 'exfiltration') and the 'techniques' (the specific method, like 'prompt injection'). It is built from real-world attacks, not theoretical ones, so it reflects what actually happens. It gives security teams a common language to describe, share, and defend against AI-specific threats, making it a practical tool for scoping security work.


## An analogy

Think of ATLAS like a detailed map of a city's crime, but for AI systems. The map is divided into districts (tactics) like 'getting in' (initial access) or 'escaping with valuables' (exfiltration). Each district has specific streets (techniques) like 'pickpocketing' (prompt injection) or 'bribing a guard' (model poisoning). Just as a police force uses such a map to allocate patrols, understand crime patterns, and communicate with each other, a security team uses ATLAS to identify which attack streets are most relevant to their AI system, to plan defences, and to speak a common language with other teams. This analogy works well because it captures the structure (tactics as districts, techniques as streets) and the purpose (planning, communication, defense). However, it breaks down because in a city, the map is static and the city doesn't change the laws of physics. In AI security, the 'terrain' changes as models and defences evolve, and many attacks are digital, not physical. The map is a living document, constantly updated as new attacks are discovered.


## Definition

MITRE ATLAS is a publicly accessible, structured knowledge base of adversarial tactics and techniques specific to AI systems, modelled on the MITRE ATT&CK framework, that catalogues real-world attacks to provide a common language and a defensive framework for AI security.


## How it connects

You have notes on AI Security as a parent concept, and on neighbouring topics like prompt injection, data poisoning, adversarial examples, and model extraction. ATLAS is the map that organiszes all these attacks. It categorizes each attack under a tactic (the goal) and a technique (the method), showing how they relate. For instance, data poisoning is a technique under 'Initial Access' or 'ML Model Access', depending on the stage. Understanding ATLAS will help you place your existing knowledge into a broader threat landscape, and it directly supports the idea that 'coverage against ATLAS is a defensible way to scope AI security work' from your library.


## Common misconceptions

**ATLAS is only for red teams** — ATLAS is just a list for attackers to pick from; it's not useful for defenders.

ATLAS is as much a defensive tool as an offensive one. Defenders use it to identify potential attack paths, prioritise defences, and detect gaps in their security posture. It provides a checklist for blue teams as well as a playbook for red teams. In fact: ATLAS is a shared framework for both attackers and defenders. Security teams use it to scope their work, design threat models, and communicate about risks internally and externally.

**ATLAS is only about LLMs** — ATLAS covers all AI systems, not just large language models.

While LLMs are a prominent part of modern AI, ATLAS covers all types of AI/ML systems, including computer vision, speech recognition, and traditional predictive models. The techniques it catalogues apply broadly across the AI lifecycle. In fact: ATLAS spans the entire spectrum of AI systems, from traditional machine learning to generative models, and includes attacks on the data, model, and deployed system.

**ATLAS is a static list** — Once an attack is in ATLAS, it stays there forever.

ATLAS is a living knowledge base that is continuously updated as new attacks are discovered and as the AI landscape evolves. Techniques may be refined, and new ones added, reflecting the changing threat landscape. In fact: ATLAS is a dynamic resource. It is regularly updated by the community and MITRE to incorporate new real-world attacks and changes in AI technology.

**ATLAS is the same as a compliance checklist** — If I cover everything in ATLAS, my AI system is perfectly secure.

ATLAS is a knowledge base of known tactics and techniques, but it is not exhaustive and does not guarantee security. New attacks may not yet be catalogued, and the presence of a technique doesn't mean it is exploitable in your specific system. Security is a continuous process, not a one-time checklist. In fact: ATLAS is a starting point for threat modelling and security planning. It helps you think about what could go wrong, but it must be combined with your system's specific context, continuous monitoring, and adaptive defences.

**ATLAS only lists theoretical attacks** — ATLAS is a list of possible attacks that haven't really happened, so it's not grounded in reality.

ATLAS is built from observations of real-world attacks. It prioritises documented incidents and case studies, not hypotheticals. Each entry is backed by evidence from actual adversarial behaviour. In fact: ATLAS is grounded in real-world attack observations. The techniques are derived from actual incidents, making it a practical and evidence-based reference.


## In short

MITRE ATLAS is your map for AI security. It structures real-world attacks into tactics (goals) and techniques (methods), giving you a common language to scope and communicate security work. Use it to understand where attacks like prompt injection and data poisoning fit, to plan defences, and to guide your security assessments.


## Where this is used

MITRE ATLAS is used across the industry in several concrete ways. For AI security professionals, it is the primary reference when conducting threat assessments. When a team wants to understand how a specific AI system could be attacked, they map the system's components against ATLAS techniques, identifying which ones apply. For example, for an LLM-based customer service chatbot, they would check techniques like 'prompt injection' and 'data poisoning', but might rule out 'physical environment manipulation' as not applicable. This scoping is a defensible way to prioritise security investments. In red teaming, ATLAS provides a playbook of attacks to test. A red team will select techniques relevant to the system and execute them, seeing if they are successful, and then report their findings against the ATLAS taxonomy. This standardised reporting helps different teams across an organisation understand the same risks. In compliance and governance, ATLAS coverage is used as evidence of due diligence. Auditors may ask for a threat model that references ATLAS and shows which techniques have been mitigated. This is practical and tangible. For builders of AI systems, ATLAS informs secure design. If a developer is building an agentic system that can call external tools, they would look at techniques under 'initial access' and 'execution' to see that 'tool poisoning' or 'insecure output handling' are potential risks, and design accordingly—for example, by sanitising tool outputs and restricting tool permissions. In large language model applications, ATLAS helps identify and categorise prompt injection attacks (a technique) under the tactic of 'initial access' or 'execution', and guides the development of defences such as input filtering and output validation. For small models running on devices, ATLAS techniques like 'model extraction' become relevant—an attacker might try to query the model on the device to replicate its behaviour, so the developer might implement rate limiting or fewer output details. In retrieval-augmented generation (RAG) systems, ATLAS highlights attacks on the retrieval pipeline, such as poisoning the vector database with malicious documents, leading to compromised results. The developer would need to validate and sanitise the documents ingested into the database. In everyday applied ML (like fraud detection), ATLAS techniques like 'data poisoning' are a concern, where an adversary might try to feed fraudulent transactions into the training data to cause the model to miss them. Developers must ensure the integrity of their training data pipelines and monitor for anomalies. The framework itself is not code, but it is used in the security lifecycle of every AI system.


---

Read this on the web: https://basavapurushottam.com/learn-ai/mitre-atlas
